I've installed Landscape on a new install of Ubuntu 16.04, and I am trying to register clients with it. We have created a CA and signed our certificate (https://help.landscape.canonical.com/LDS/SSL). We also added the certificate to the trusted certificates on the client.

Now we try to connect our client (Ubuntu 16.04) to the Server with the following command:

sudo landscape-config --computer-title "Agent" --account-name standalone  --url https://landskap/message-system --ping-url http://landskap/ping --ssl-public-key=/etc/ssl/certs/landscape_server_ca.pem

After the configuration dialog this error message appears:

The server's SSL information is incorrect, or fails signature verification! If the server is using a self-signed certificate, please ensure you supply it with the --ssl-public-key parameter.

Yes our server is called 'Landskap'...

We've checked on the client, if there is any additional information in /var/log/landscape/broker.log and found the following error entry.

PyCurlError: Error 60: server certificate verification failed. CAfile: /usr/local/share/ca-certificates/landscape_server_ca.crt CRLfile: none
2017-04-18 14:08:38,978 ERROR    [MainThread] Message exchange failed: server certificate verification failed. CAfile: /usr/local/share/ca-certificates/landscape_server_ca.crt CRLfile: none
2017-04-18 14:08:38,978 INFO     [MainThread] Message exchange failed.
2017-04-18 14:08:38,979 INFO     [MainThread] Message exchange completed in 0.17s.
2017-04-18 14:09:38,982 INFO     [MainThread] Starting urgent message exchange with https://landskap/message-system.
2017-04-18 14:09:39,149 ERROR    [PoolThread-twisted.internet.reactor-0] Error contacting the server at https://landskap/message-system.
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/landscape/broker/transport.py", line 71, in exchange
    message_api)
  File "/usr/lib/python2.7/dist-packages/landscape/broker/transport.py", line 45, in _curl
    headers=headers, cainfo=self._pubkey, curl=curl))
  File "/usr/lib/python2.7/dist-packages/landscape/lib/fetch.py", line 109, in fetch
    raise PyCurlError(e.args[0], e.args[1])

Please help us :(

up vote 2 down vote accepted

Unable to test currently, but the Quick Start Guide suggests to add the certificate file to /etc/landscape/client.conf with this line:

ssl_public_key = /etc/landscape/server.pem
  • Thanks for your reply. The configuration command already added this line to the configuration file. The error still appears. – Jonas Mock Apr 19 '17 at 5:53

We found out that the quickstarter installation already generates a certificate by himself. There is no need to generate another one. Simply copy the certificate from /etc/landscape/landscape_server.pem to the client's /etc/landscape/folder. The recommendation of @Grayson Kent was correct. Add the following line to the configuration file in /etc/landscape/client.conf ssl_public_key = /etc/landscape/landscape_server.pem

I recently struggled with this problem as well. For me, however, the solution provided for the limited problem description was not the right path.

My problem for this exact same error code was that my SSL certificate expired. Please see my experience and troubleshooting steps to determine the problem on my blog at http://realworldnumbers.com/ubuntu-landscape-problems/ .

Essentially,

  1. Check broker logs on one of the client systems.

    tail -n 100 /var/log/landscape/broker.log | grep certificate
    
  2. If you see Error 60, try verifying the certificate using curl. Verify the certificate using a curl command to the IP address of the Landscape server. In my case this was:

    $ curl https://192.168.168.67/message-system
    curl: (60) server certificate verification failed.
    
  3. Use openSSL to verify the specific details about the certificate chain.

    openssl s_client -connect 192.168.168.67:443
    

    In my case, the important parts of this output that indicated expired certificate was:

    Verify return code: 10 (certificate has expired)
    verify error:num=10:certificate has expired
    notAfter=Sep 23 00:00:19 2017 GMT
    

So you'll have to generate and sign a new certificate using the instructions at the landscape help documentation. My recommendation here is to generate a 30 year CA and certificate. The default was 1 year and I can't imagine updating the cert on an annual basis. There doesn't seem to be a warning alert to this expiring certificate within Landscape itself.

  • You could improve your answer for future readers by summarizing the steps necessary to check and correct the problem. – J. Starnes Nov 6 '17 at 0:11
  • Could - but then i'd just be repeating myself. Did this help you, or just lurkin? – Patrick Scott Best Nov 7 '17 at 13:32
  • As a first answer the system placed your post the review queue. The Stack exchange system then let other users know that there were items that needed reviewed, I was one of those users. Based on the review guide lines for link only answers, I commented on your answer to suggest an improvement. – J. Starnes Nov 7 '17 at 15:31
  • OK, cool. I'll be happy to update with a little more detail. – Patrick Scott Best Nov 9 '17 at 2:16

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.